topic Re: Client isolation on vSZ in ZoneDirector

Client isolation on vSZ

adrian_kaegi — Sat, 23 Jan 2016 15:20:09 GMT

Hi
i configured client isolation on vSZ. Its working from Wifi client to wifi client. But i can reach hosts connected with ethernet cable in the same subnet.
ok... so i tryed to place a L2 Access list, to allow only traffic to Gateway, dhcp and broadcast. but it seems, that this ACL uses the MAC adresses as source MAC and not destination. ... so i have to add all wifi clients, and this is not possible...
Is there another way to place a L2 or L3 ACL? How can i setup a isolation with cabled hosts in the net?

Thank you very much!
Adrian

Re: Client isolation on vSZ

andrea_coppini — Sat, 23 Jan 2016 15:50:33 GMT

When Client Isolation = Yes, it should result in WiFi clients not being able to communicate with each other but they should be able to communicate with the Default Gateway (which is learned via DHCP traffic).

Do you have a DHCP server running on this SSID?
Are you trying to communicate with an IP which is not listed in the DHCP Response?

Re: Client isolation on vSZ

adrian_kaegi — Sat, 23 Jan 2016 16:58:33 GMT

Yes there is a DHCP Server in place.
What do you mean with, not listed in the dhcp response?
The IP which i tried to ping was de domain controller in this network, and because its a guest wlan this access should not be able... as far i remember the IPs which i could ping was fix configured IPs, at least the Server was fix for shure.

But i have to test again with focus on dynamic configured IPs next week.
It is the only way to block theese access with a L2 access List and block mac addresse from the Server?

Re: Client isolation on vSZ

andrea_coppini — Sat, 23 Jan 2016 17:02:15 GMT

Take a look at https://support.ruckuswireless.com/answers/000005359 to understand how CI works.

In simple terms, to make CI work correctly, you need to design your network to have nothing but a default gateway and DHCP server on your guest VLAN.

Re: Client isolation on vSZ

seanmuir — Sun, 24 Jan 2016 21:36:00 GMT

You could create an ACL on your network to prevent wireless cleints seeing your internal cabled network:

http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

Good luck